Secrets Management GCLD Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company uses GitHub Actions to deploy to AWS. They need to pass database credentials to the deployment job without exposing them in the workflow logs. They also want to ensure that only the production deployment workflow can access the production database credentials. What should they do?

   • AUse a service account with broad permissions and store its key in the repository as a base64-encoded variable.
   • BRetrieve the credentials at runtime from a public S3 bucket and use them in the deployment script.
   • CHardcode the credentials in the workflow YAML file and restrict access to the repository.
   • DStore the credentials as encrypted secrets in GitHub and reference them in the workflow using the secrets context, then restrict the environment to production.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security analyst notices that a service account is reading a secret every minute, which is unusual. The secrets manager has audit logging enabled. What is the BEST way to determine if this is a security incident?

   • AIgnore the behavior because the service account is authorized to read the secret.
   • BChange the secret's permissions to deny access to the service account.
   • CImmediately rotate the secret and disable the service account.
   • DReview the audit logs to see which user or service account is accessing the secret, from which IP address, and at what times.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security team wants to reduce the risk of a long-lived database password being compromised. They decide to rotate the password every 30 days. What is the MOST important consideration when implementing automated rotation?

   • ARotate the password only when a compromise is suspected.
   • BDisable versioning on the secrets manager to prevent old passwords from being used.
   • CUse the same password for all databases to simplify rotation.
   • DEnsure that all applications that use the password are updated to retrieve the new version from the secrets manager.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A cloud application needs to authenticate to a third-party service using an API key. The key is stored in a secrets manager. The application is deployed on virtual machines. What is the recommended way for the application to retrieve the key at runtime?

   • AUse the secrets manager SDK with the VM's managed identity to fetch the key at startup.
   • BEmbed the API key in the application's source code and compile it into the binary.
   • CStore the API key in a plain text file on the VM's local disk.
   • DPass the API key as a command-line argument when starting the application.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which of the following is a dedicated cloud service specifically designed for centralized secrets management?

   • AAzure Key Vault
   • BGoogle Cloud Storage
   • CAWS S3
   • DAWS EC2
   Reveal Solution Discussion Select an answer first